How to fix Disconnecting: Too many authentication failures in SSH

The most effective fix is to tell SSH to use a specific key file, bypassing the ssh-agent:

ssh -i ~/.ssh/correct_key.pem user@hostname

This avoids trying multiple keys and ensures only the correct key is sent in the first attempt. Replace correct_key.pem with your actual key filename.

Add a Host section to ~/.ssh/config that specifies exactly which key to use and prevents offering others:

Host myserver
    HostName example.com
    User myuser
    IdentityFile ~/.ssh/correct_key.pem
    IdentitiesOnly yes
    ConnectTimeout 10

The critical setting is IdentitiesOnly yes, which tells SSH to only use the specified IdentityFile and ignore all keys in ssh-agent. Now connect simply with:

ssh myserver

If you have many keys loaded in ssh-agent, you can temporarily remove all of them and add back only the one you need:

# Remove all keys from the agent
ssh-add -D

# Add only the key you need
ssh-add ~/.ssh/correct_key.pem

You'll be prompted for the key's passphrase (if it has one). After this, SSH will only offer that single key when connecting, avoiding the MaxAuthTries limit.

To see what keys are currently loaded:

ssh-add -l

If you're trying to log in with a password instead of a key, you can skip the publickey attempts entirely:

ssh -o PubkeyAuthentication=no user@hostname

This forces password authentication and avoids the client offering keys that don't match. You'll be prompted for the password instead.

Add this to your SSH config if you want it to persist:

Host myserver
    HostName example.com
    PubkeyAuthentication no

Make sure the public key on your client matches what's configured on the server:

On your client machine, display your public key:

cat ~/.ssh/correct_key.pub

Then, log into the server (or ask the administrator) and check if your public key is in ~/.ssh/authorized_keys:

grep "YOUR_PUBLIC_KEY_CONTENT" ~/.ssh/authorized_keys

If it's not there, you need to add it to the server's authorized_keys file:

echo "your-public-key-content" >> ~/.ssh/authorized_keys
chmod 600 ~/.ssh/authorized_keys

Add -v flags to SSH to see detailed debug output about which keys are being tried:

ssh -v user@hostname

For even more detail:

ssh -vv user@hostname
ssh -vvv user@hostname

Look for lines like:

Trying private key: /home/user/.ssh/id_rsa
Trying private key: /home/user/.ssh/id_ed25519
Trying private key: /home/user/.ssh/id_ecdsa

This shows which keys are being attempted in what order. If you see many attempts and then "Disconnecting: Too many authentication failures", you know the issue is too many keys being tried.

If you're the server administrator and need to allow more authentication attempts, edit /etc/ssh/sshd_config:

sudo nano /etc/ssh/sshd_config

Find the line MaxAuthTries (it may be commented out with #) and change it:

MaxAuthTries 10

Then restart the SSH daemon:

sudo systemctl restart sshd

Warning: Increasing this setting makes your server slightly more vulnerable to brute force attacks. Only do this if you have a specific reason (e.g., many automated keys being offered) and preferably combined with other security measures like disabling password authentication and using firewall rules.